fix: two silent setters, and the warnings that were pointing at them

[rubenvdlinde]

The suite reported 10 PHP warnings and 23 deprecations. Two of the warnings were not hygiene — they were production bugs, and both had been written into the tests as known behaviour.

Organisation::setActive(false) never deactivated anything

It called parent::setActive(active: $value) with a named argument. Entity has no such method: it is reached through __call(array $args), where a named argument lands under its name, so Entity::setter() read an undefined $args[0] and the value never arrived. OrganisationController has an endpoint whose whole job is deactivating an organisation, and it could not work.

OrganisationTest asserted assertTrue() on a value that should have been false, and called it "the current actual behavior".

EndpointLog::setResponse() stored NULL on every call log

Same root cause, same shape. setStatusCode and setStatusMessage were positional and worked; the response payload was dropped on every endpoint call ever logged.

EndpointServiceTest said "setResponse uses named arg in source code (known issue), so response may be null. We verify it was attempted" — and then verified nothing.

Both fixed, both now assert correct behaviour. Negative controls run, not assumed: reintroducing either bug reddens its test.

The class, not just the instances

94 Entity subclasses, 686 magic setter names, 256 named-argument call sites in lib/. Every other match is legitimate: $objectService->setRegister() is a real service method, ->setObject(type:, id:) is OCPs INotification, and my last two candidates were the regex matching self::` in a class constant. The class is bounded at these two sites.

Worth knowing for next time: the cause surfaced as Undefined array key 0 pointing into vendor/nextcloud/ocp/.../Entity.php, where it reads as somebody else`s problem. It was ours both times.

The rest

Fix	Why
SettingsController	while ($row !== false) never terminates if fetch() answers null, which it can. Two other loops in the same file already used is_array().
BsnFormat	str_pad() was handed a null — deprecated in 8.1, a TypeError in 9. Cast once up front; array/object now refused explicitly, which is the contract str_pad() used to enforce further down by accident.
SaveObject	A schema with a null slug cannot be found BY slug, and feeding the null to strtolower()/strcasecmp() is deprecated. Skipped instead.
5 test files	Mocks answering [] or null where the single real implementation always fills the contract (rechainAll, processSourceChunks, handlePreValidationCascading). The mocks were made to keep the contract rather than the services made defensive about a fake.
RechainAuditTrailCommandTest	Gained the tombstone-count assertion its output message never had.
Dynamic properties / setValue()	Declared; and ReflectionProperty::setValue() given its explicit null object argument at 14 sites.

Result

19046 tests. Warnings 10 → 0, deprecations 23 → 2, risky 3 → 0 (the risky three landed separately in #3351).

The last two deprecations are ZipArchive::open() on an empty fixture file, left alone deliberately: the fixture is empty on purpose and changing it would change what the test exercises.

🤖 Generated with Claude Code

[github-actions]

Quality Report — ConductionNL/openregister @ 15c847d

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-specs		✅
test-l10n		✅
test-l10n-parity		✅
format		✅
check-schema-l10n		✅
check-l10n-js		✅
composer			✅	✅ 174/174
npm			✅	✅ 543/543
app:check-code	⏭️
info.xml	✅
REUSE	❌
PHPUnit					✅
Newman					✅
Playwright					⏭️ deferred — runs on the promotion into beta/main, not on a pull request into development
Hydra gates					✅

---

Quality workflow — 2026-09-03 08:10 UTC

Download the full PDF report from the workflow artifacts.